Next.js Race Condition to Cache Poisoning
翻訳中…プラットフォーム
nodejs
コンポーネント
next
修正版
14.2.25
15.0.1
14.2.24
CVE-2025-32421 describes a low-severity race condition vulnerability discovered in Next.js. This flaw, reported by Allam Rachid (zhero), can lead to misconfigured Pages Router endpoints serving pageProps data instead of standard HTML. The vulnerability impacts versions of Next.js prior to 14.2.24 and has been resolved with the release of version 14.2.24.
影響と攻撃シナリオ翻訳中…
The primary impact of CVE-2025-32421 is the potential for unexpected behavior in Next.js applications. An attacker, exploiting a misconfigured Pages Router, could potentially manipulate the data served to users, leading to incorrect rendering or unexpected application state. While the severity is rated LOW, this could still lead to user confusion or, in more complex scenarios, potential data integrity issues. The vulnerability does not appear to enable remote code execution or direct data theft, but the misrepresentation of data could be leveraged in social engineering attacks or to disrupt application functionality.
悪用の状況翻訳中…
CVE-2025-32421 was publicly disclosed on 2025-05-15. There are currently no known public exploits or active campaigns targeting this vulnerability. The vulnerability was discovered and responsibly disclosed by Allam Rachid (zhero) as part of the Next.js bug bounty program. Its low severity and lack of public exploits suggest a low probability of exploitation.
リスク対象者翻訳中…
Applications utilizing the Next.js Pages Router, particularly those with custom routing configurations or deployments that deviate from standard Next.js practices, are at increased risk. Developers who have not upgraded to the latest version of Next.js are also potentially vulnerable.
検出手順翻訳中…
• nodejs: Monitor application logs for unusual pageProps data being served instead of standard HTML.
grep 'pageProps' /path/to/your/app/logs/*.log• nodejs: Check Next.js configuration files for misconfigurations in the Pages Router.
• generic web: Use curl to test endpoints and verify that they return expected HTML content.
curl -I https://your-nextjs-app.com/your-endpoint攻撃タイムライン
- Disclosure
disclosure
脅威インテリジェンス
エクスプロイト状況
EPSS
0.36% (58% パーセンタイル)
CISA SSVC
CVSS ベクトル
これらのメトリクスの意味は？
- Attack Vector
- ネットワーク — インターネット経由でリモートから悪用可能。物理・ローカルアクセス不要。
- Attack Complexity
- 高 — 競合条件、非標準設定、または特定の状況が必要。悪用が難しい。
- Privileges Required
- なし — 認証不要。資格情報なしで悪用可能。
- User Interaction
- なし — 自動かつ無音の攻撃。被害者は何もしない。
- Scope
- 変化なし — 影響は脆弱なコンポーネントのみ。
- Confidentiality
- 低 — 一部データへの部分的アクセス。
- Integrity
- なし — 完全性への影響なし。
- Availability
- なし — 可用性への影響なし。
影響を受けるソフトウェア
パッケージ情報
- 最終更新
- 16.2.6最近
弱点分類 (CWE)
タイムライン
- 予約済み
- 公開日
- 更新日
- EPSS 更新日
緩和策と回避策翻訳中…
The recommended mitigation for CVE-2025-32421 is to upgrade to Next.js version 14.2.24 or later. This version includes a fix that addresses the race condition. If upgrading is not immediately feasible, carefully review your Pages Router configuration to ensure it adheres to best practices and avoids the specific misconfigurations that trigger the vulnerability. Consider implementing stricter input validation and output sanitization to further reduce the potential impact of this vulnerability. After upgrade, confirm the fix by testing endpoints that previously exhibited the described behavior.
修正方法翻訳中…
Actualice Next.js a la versión 14.2.24 o superior, o a la versión 15.1.6 o superior. Si no puede actualizar inmediatamente, mitigue la vulnerabilidad eliminando el encabezado `x-now-route-matches` de todas las solicitudes entrantes en la red de entrega de contenido y estableciendo `cache-control: no-store` para todas las respuestas en riesgo. Se recomienda encarecidamente almacenar en caché solo las respuestas con encabezados `cache-control` explícitos.
CVEセキュリティニュースレター
脆弱性分析と重要アラートをメールでお届けします。
よくある質問翻訳中…
What is CVE-2025-32421 — Race Condition in Next.js?
CVE-2025-32421 is a low-severity race condition in Next.js affecting the Pages Router. It can cause endpoints to serve pageProps data instead of standard HTML, potentially leading to unexpected application behavior.
Am I affected by CVE-2025-32421 in Next.js?
You are affected if you are using a version of Next.js prior to 14.2.24 and have misconfigured the Pages Router. Review your configuration and upgrade to mitigate.
How do I fix CVE-2025-32421 in Next.js?
Upgrade to Next.js version 14.2.24 or later. Review and correct any misconfigurations in your Pages Router setup.
Is CVE-2025-32421 being actively exploited?
Currently, there are no known public exploits or active campaigns targeting CVE-2025-32421. However, it's still important to apply the fix.
Where can I find the official Next.js advisory for CVE-2025-32421?
You can find the official advisory on the Vercel changelog: https://vercel.com/changelog/cve-2025-32421